CVE-2019-9881
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated...
CVE-2019-9881 is a medium vulnerability (CVSS 5.3) in Wpengine Wpgraphql, published June 10, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.4%, the 97th percentile. No source names a fixed version.
- Severity
- 5.3 MediumCVSS 3.0, NVD
- Exploit chance
- 18.4%EPSS, 97th percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities | 2019-05-21 |
| Nuclei | WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting |
What each source reports
NVD Score used
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
CVE-2019-9881- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE ListNo score
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
CVE-2019-9881- Updated
- 2026-11-02
EUVDEUVD-2019-19237No score
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
EUVD-2019-19237- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhwc-x32h-p6qg
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated...
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
GHSA-hhwc-x32h-p6qg- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
CVE-2019-9881- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-10
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
wpvulndb.com/vulnerabilities/9282
packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html
pentestpartners.com/security-blog/pwning-wordpress-graphql
github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py
nvd.nist.gov/vuln/detail/CVE-2019-9881